AI coding agents breached through sandbox escapes

Pillar says several popular AI coding agents can be manipulated into helping attackers break past their sandbox protections, undermining a core security claim behind these tools.

Over a span of a couple of months, the security researchers found ways to reproduce sandbox escapes and boundary bypasses in Cursor, Codex CLI, Gemini CLI, and Antigravity. The attack path described in the report is simple in principle: an attacker plants malicious content in a repository — such as a README or dependency — and convinces a developer to use it.

Those instructions can lead the coding agent to create or modify a project configuration file inside the workspace, where the activity appears normal. The real problem comes next: a trusted component outside the sandbox, such as Git integration, an IDE extension, or a local daemon, reads that altered configuration and executes attacker-written commands with its own privileges.

Recommended reading

Estée Lauder discloses Oracle breach nearly a year later

Fixes and affected versions

According to Pillar, three of the four affected platforms have already fixed the issues:

• Cursor patched multiple flaws in version 3.0.0; one was assigned CVE-2026-48124, while another is tracked via a GitHub Security Advisory
• Codex CLI fixed the issue in version 0.95.0, but said it is still waiting for a CVE
• Gemini CLI was affected by a Docker daemon issue, which the report says was fixed through advisory GHSA-v4xv-rqh3-w9mc

For Antigravity, Google acknowledged both reported sandbox bypasses as valid findings, but categorized them as “Other valid security vulnerabilities” and lowered their severity, saying exploitation appears relatively difficult.

“When it comes to agents, the sandbox boundary that developers expect in coding tools — one that keeps the agent inside the sandbox and the user outside — breaks down.” “The boundary we kept finding was both messier and porous, because If an agent gets to write the future inputs of systems, it was never sandboxed in the first place.” “This is why agentic security requires its own threat model.”

×